Snort Bypass Vuln Patch Up!

This was sent to the Bleeding Snort Signature mailing list from Demarc Security. I have not seen this info anywhere on Bugtraq or any disclosure so patch up before poeple start trying to dodge your IDS.

pasted the info below and heres a link to a patch and pre-packaged tarball
http://www.demarc.com/support/downloads/patch_20060531


A large scale Snort evasion has been discovered by Blake Hartstein, a member of the Demarc Threat Research Team.

The evasion technique allows an attack to bypass detection of "uricontent" rules by adding a carriage return to the end of a URL, directly before the HTTP protocol declaration.

This affects thousands of rules in the standard Snort base rule sets.

For example, in order to evade detection of an AwStats Vulnerability (sid:3813), using netcat:

$ perl -e'print "GET /awstats.pl?configdir=|backdoor\r http/1.0\r\n\r\n"'|nc vulnerable.server 80



Due to the seriousness of this vulnerability, we have developed a patch for public review. See below.

This patch addresses the carriage return bug and catches the known evasion attempts but further research should be done to determine if there are any other possible impacts of this bug. The detection for evasion is turned on by default under all profiles but can also be used as a server configuration option:


-----HTTP Inspect Server Configuration-----

non_std_cr <yes|no>

This option generates an alert when a non standard carriage return character is detected in the URI.

-----end-----



With the release of this information we have also released a fix to all our Sentarus customers. If your auto-updates are turned on, then a patch and all related updates have already been applied, or you can go into your Sentarus management console and request an immediate update.